You tapped a suspicious link, then realized something felt wrong. The good news is that clicking alone does not automatically mean your accounts have been taken over. The risk depends on what happened next: did you enter a password, approve a login prompt, download a file, or install an app?
The right response is specific. Work through these steps rather than following panic-driven advice from another suspicious website.
If you only opened the page
Close the page. Don’t give it permissions to send notifications, download files, or access your location. Update your browser and device if updates are pending. If an unexpected download appeared, avoid opening it, and delete it where appropriate.
A malicious page can sometimes exploit a browser vulnerability, so no one can promise zero risk. But without an additional action, the immediate response is usually less disruptive than if credentials were submitted.
If you entered a password
Go directly to the real website by opening its saved bookmark or typing its address yourself. Change the affected password immediately, especially if you have used it on other sites. Change every reused password, starting with your primary email.
Enable a passkey or multi-factor authentication where available. Review connected devices, sessions, forwarding rules, and account recovery settings. Sign out unfamiliar sessions and revoke suspicious connected apps.
If you entered a verification code
Treat the account as potentially compromised. A one-time code might have allowed an attacker to complete a login or recovery flow. On the legitimate service, change account credentials, review recent login activity, and invalidate unknown sessions as quickly as possible.
A passkey or hardware security key may be more resistant to lookalike websites than a code you can type into a fake form. Still keep a safe recovery method.
If you downloaded or installed something
Do not run an unexpected installer. If you already ran it or gave it broad permissions, disconnect the device from the network if you suspect active malware, run a reputable security scan, and seek professional support for work devices or serious incidents.
Do not type new passwords into a device you believe remains infected. Use a trusted alternative until the device has been assessed or restored.
If you provided payment details
Contact your bank or card provider using its official contact details, explain the situation, and monitor transactions. Ask whether the card or payment access should be blocked and replaced. Do not assume the page has been deleted just because it now fails to load.
Report the attempt
Save a non-sensitive copy of the suspicious message and report it using your email provider’s phishing-report feature, the impersonated service, or the appropriate national consumer protection channel. This can help protect others.
What to remember: identify exactly what you shared or ran, then protect the relevant account or device. The first question is not “Did I click?” but “What access did I give?”